Описание
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
Ссылки
- Broken Link
- ProductRelease Notes
- Patch
- ProductRelease Notes
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
6.8 Medium
CVSS3
8.1 High
CVSS3
Дефекты
Связанные уязвимости
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
EPSS
6.8 Medium
CVSS3
8.1 High
CVSS3